KR102354094B1 - Method and Apparatus for Security Management Based on Machine Learning - Google Patents

Abstract

Disclosed is a machine learning-based security control device and method for detected cybersecurity threats.
This embodiment uses a machine learning-based inference model for security threat detection events provided by existing security solutions and detection equipments. An object of the present invention is to provide a security control device and method capable of automatically inferring a response plan for a detection event.

Description

Machine learning-based security control device and method {Method and Apparatus for Security Management Based on Machine Learning}

The present invention relates to a machine learning-based automated security control apparatus and method for a detected cybersecurity threat event.

The content described below merely provides background information related to the present invention and does not constitute the prior art.

Due to the expansion of new IT service environments such as cloud, Internet of Things (IoT), and mobile, overall information technology (IT) resources are rapidly increasing. On the other hand, cyber security threats are rapidly increasing for IT asset infrastructure, network, database, and the like. In addition to the occurrence of existing types of threats, new types of cybersecurity threats are accumulating. Therefore, it is becoming increasingly difficult to respond to the total amount of cyber security threats only with the manual work of a security management expert.

On the other hand, cyber attackers, such as hackers and crackers with malicious intent, use automation technology or imitate regular user behavior based on adversarial learning to create security solutions (security solutions). solutions) and detection equipments. Reflecting this trend of attackers, the use of intelligent technology is continuously pushing for increased detection automation and detection range for the increasing number of cyber threat attempts. However, although technological advances in security solutions and detection equipment enable more efficient detection of various threats, it is also a reality that shows side effects such as an increase in over-detection and erroneous detection.

The increase in over-detection and false-detection has a negative impact on cyber security control and monitoring services that ultimately respond to threat detection. The final response process to analyze the detected security threat requires manual analysis by a skilled and experienced security control expert. Among the detection events of security solutions for automated attacks, only a very small number of effective cyber threats and the rest are invalid events, so the efficiency of manual security control and monitoring tasks is lowering.

As a solution to the manual problem, in order to remove an invalid security threat detection event in advance, a response technique that relies on a rule may be considered. However, since the rule-based technology is difficult to create and manage a prior removal rule, it can be used only for simple or extremely obvious data removal, and thus has a limitation in prior removal of invalid events.

As another conventional technique for solving problems caused by manual work, there is a technique for applying a simple statistical method to a detected event (see Patent Document 1). In the simple statistics-based technology, a final judgment as to whether the detection event is a threat is determined by extracting simple statistics (eg, frequency) of the current security threat detection event and comparing it with previously accumulated statistics. Although manual work on detected events can be partially replaced, it is difficult for simple statistical-based techniques to take into account the complexity of detection events, and application of this technique may lead to another error. In addition, there is a disadvantage that manual review must be added due to a decrease in the reliability of the final judgment.

Therefore, in order to cope with security threats, an automatic response method capable of minimizing the burden of manual work for detection events is required.

Patent Document 1: Korean Patent Laid-Open Patent Publication, 10-2018-0080449, "Method and device for detecting cyber-intrusion threats through correlation analysis of security events"

The present disclosure uses a machine learning-based inference model for security threat detection events provided from existing security solutions and detection equipments. A main object of the present invention is to provide a security control device and method capable of automatically inferring a response plan for a detection event.

According to an embodiment of the present invention, an input unit for acquiring detection events for a security threat; an encoding unit converting the detection event into input data; a correspondence inference unit for selecting one inference model from a group of inference models including at least one inference model, and inputting the input data into the selected inference model to infer a corresponding method for the detection event; Provide a security control device comprising: a reliability calculation unit for calculating the reliability of the countermeasure based on the predicted probability of the countermeasure; and a response execution unit for executing the countermeasure depending on the calculated reliability do.

According to another embodiment of the present invention, there is provided a learning method for a security control device, the method comprising: acquiring detection events and labels for a security threat; extracting feature data from the detection event and converting a character or character string constituting the feature data into input data; generating ensemble data for at least one inference model based on machine learning by applying bagging to the input data; generating an inference result by applying the ensemble data for each inference model; calculating the reliability of the inference result for each inference model, and accumulating the reliability to calculate the cumulative reliability; and updating parameters for each inference model based on the inference result and the label.

According to another embodiment of the present invention, there is provided a security control method of a security control device, the method comprising: acquiring detection events for a security threat; extracting feature data from the detection event and converting a character or character string constituting the feature data into input data; selecting one inference model from a group of inference models including at least one pre-trained inference model, and inputting the input data into the selected inference model to infer a countermeasure for the detection event; and calculating the reliability of the countermeasure, and executing the countermeasure depending on the reliability.

According to another embodiment of the present invention, there is provided a computer program stored in a computer-readable recording medium in order to execute each step included in the learning method of the security control device.
According to another embodiment of the present invention, there is provided a computer program stored in a computer-readable recording medium in order to execute each step included in the security control method of the security control device.

As described above, according to this embodiment, the detection event is analyzed using a machine learning-based inference model for the security threat detection event provided from the existing security solutions and detection equipments. By providing a security control device and method capable of automatically inferring a countermeasure against a countermeasure, it is possible to improve the reliability of the automated analysis and countermeasure, and to minimize the manual analysis and response process of a security expert.

In addition, according to the present embodiment, by providing an automated security control device and method based on machine learning, over-detection and erroneous detection are performed in advance with respect to a previously detected event of a security solution and detection equipment. There is an effect that it becomes possible to discriminate and remove it.

In addition, according to this embodiment, by providing an automated security control device and method based on machine learning, while correcting errors in the existing response results, in using the existing accumulated results, the differences in the capabilities of individual security experts There is an effect that it becomes possible to minimize the uncertainty due to the level difference of the resulting countermeasures.

1 is an exemplary diagram of a conventional security control system in which a security control expert is involved.
2 is a block diagram of a security control device according to an embodiment of the present invention.
3 is a conceptual diagram for learning of an inference model group according to an embodiment of the present invention.
4 is a flowchart for training of an inference model according to an embodiment of the present invention.
5 is a flowchart of a security control method according to an embodiment of the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of the present invention will be described in detail with reference to exemplary drawings. In adding reference numerals to the components of each drawing, it should be noted that the same components are given the same reference numerals as much as possible even though they are indicated on different drawings. In addition, in the description of the present embodiments, if it is determined that a detailed description of a related well-known configuration or function may obscure the gist of the present embodiments, the detailed description thereof will be omitted.

Also, in describing the components of the present embodiments, terms such as first, second, A, B, (a), (b), etc. may be used. These terms are only for distinguishing the elements from other elements, and the essence, order, or order of the elements are not limited by the terms. Throughout the specification, when a part 'includes' or 'includes' a certain element, this means that other elements may be further included, rather than excluding other elements, unless otherwise stated. . In addition, the '... Terms such as 'unit' and 'module' mean a unit that processes at least one function or operation, which may be implemented as hardware or software or a combination of hardware and software.

DETAILED DESCRIPTION The detailed description set forth below in conjunction with the appended drawings is intended to describe exemplary embodiments of the present invention and is not intended to represent the only embodiments in which the present invention may be practiced.

This embodiment discloses a machine learning-based automated security control apparatus and method for a detected cyber security threat. In more detail, detection events (detection events, hereinafter) provided from existing security solutions and detection equipments are detected using a machine learning-based inference model. A security control device and method capable of automatically inferring a response plan for an event are provided.

1 is an exemplary diagram of a conventional security control system in which a security control expert is involved.

In the conventional security control system 110, N (N is a natural number) protection target groups are customers who provide a security threat detection event. Subjects that generate events in each protected group include endpoint security devices, network security devices, intrusion detection systems (IDS: Instruction Detection System and IPS: Instruction Prevention System), and web firewalls. It can be a security solution that Since the description of each security solution is out of the scope of the present invention, further detailed description will be omitted.

The detection events generated in each protection target group are collected, interpreted, and refined, and then stored in the large-capacity big data analysis module 111 .

In security control, the event stored in the big data analysis module 111 is preferentially analyzed using a search, statistics, visualization method, etc. according to necessary conditions. Based on the following analysis results, a security control expert performs manual analysis of security threats, and stores the impact level, response and action results in the threat response history DB (112, Database). After the statistical analysis of the stored results, a final report is prepared and sent to the relevant customer.

The security control device 100 according to the present embodiment aims to replace or supplement the analysis of the detection event and the manual analysis of the security control expert as described above.

It is assumed that the security control apparatus 100 according to the present embodiment is mounted on a server (not shown) or a programmable system having a computing capability equivalent to that of the server. It is assumed that the server acquires a detection event from a plurality of security solutions and detection equipments using a wired or wireless transmission method.

Hereinafter, a security control device according to the present embodiment will be described with reference to FIG. 2 . 2 is a block diagram of a security control device according to an embodiment of the present invention.

In an embodiment of the present invention, the security control device 100 uses a machine learning-based inference model for the acquired detection event. Automatically infer a response plan for a detection event. The security control device 100 includes an input unit 200, a rule-based filter unit 210, a pre-processing and encoding unit 220, a correspondence inference unit 230, a reliability calculation unit 240, a correspondence execution unit 250, and All or part of the training unit 260 is included. Here, the components included in the security control device 100 according to the present embodiment are not necessarily limited thereto. For example, a training unit (not shown) for training an inference model may be additionally provided on the security control device 100 .

The illustration of FIG. 2 is an exemplary configuration according to the present embodiment, and implementation including other components or other connections between components is possible according to a preprocessing and encoding method, a structure and operation of an inference model, a method of using reliability, and the like.

The input unit 200 according to the present embodiment acquires a detection event from security solutions and/or detection equipments.

The rule-based filter unit 210 according to the present embodiment performs filtering based on a preset rule before inferring a response method for a detection event. The rule-based filter unit 210 may include a rule DB 211 for storing pre-set rules and a response method DB 212 for storing a corresponding method.

The rule-based filter unit 210 refers to the rule DB 211 and executes rule-based filtering. When the detection event matches the rule, the rule-based filter unit 210 refers to the response plan DB 212 and executes a response plan such as prior removal, blocking, or notification for the detection event. For example, detection events originating from well-known attack locations such as blacklist Internet Protocol (IP) addresses may be removed. When the response to the detection event is executed, the security control device 100 may omit the inference process of the response method for the detection event.

The pre-processing and encoding unit 220 according to the present embodiment executes a pre-processing process to compensate for deviations between security solutions for detection events, and executes an encoding process for generating input data in a form suitable for a machine learning-based inference model. do.

In the preprocessing process, the preprocessing and encoding unit 220 may fill in an empty space in the detection event and correct an error included in the detection event.

In the encoding process, the pre-processing and encoding unit 220 extracts feature data from the detection event, digitizes characters or strings constituting the feature data, and converts them into input data.

The feature data that can be extracted from the detection event includes a detection ID number and a detection rule name of a detection rule, information related to the occurrence time of the detection event, information on the threat target, and detection The underlying signature, the type of detection equipment, the manufacturer of the detection equipment, severity estimation information for the detection result, information on the source of the threat (such as the source country or source IP address), information on the destination of the threat (such as the destination country or destination) IP address, etc.), service and port information used by the threat, protocol used by the threat, network information and packet information, contents included in the packet payload, Uniform Resource Locator (URL) and Uniform Resource Identifier (URI) information All or part of, etc. are included, but are not necessarily limited thereto, and any information that can express other security threats may be added.

In the feature extraction process, derived feature data such as the processing time required and the frequency per unit time, the number of occurrences of similar attack types, and session information for the same origin and the same destination may be generated using the feature data.

In addition, in the feature extraction process, a multi-dimensional matrix is generated using feature data or derived feature data, or feature data or derived feature data having time-series information is converted into a time-series or sequential variable can be

In the encoding process, input data in a form suitable for a machine learning-based inference model is generated based on the result of the feature extraction process.

In this embodiment, the input data may be one-hot encoding data or label encoding data. Here, the one-hot encoding data is data in which only one of the entire components is displayed as a numerical value and the remaining components are displayed as 0. On the other hand, label-encoded data with a reduced dimension compared to the one-hot-encoded vector is data represented by continuous numbers.

In another embodiment of the present invention, the input data may be data generated by an auto-encoder based on a neural network.

The correspondence inference unit 230 according to the present embodiment inputs input data to the inference model to infer whether the detection event is a security threat and a countermeasure for the detection event. Correspondence inference unit 230 includes an inference model group 231 including M (M is a natural number) inference models. The correspondence inference unit 230 infers a corresponding method by using one inference model selected from among the M inference models.

The selected inference model may be a model having the highest cumulative reliability according to a result of prior learning for the M inference models. The inference model may be selected differently depending on initial learning, incremental learning, renewal learning, and the like. The learning process for the inference model will be described later.

Another inference model may be selected according to the cumulative reliability according to the inference result. Selection of an inference model based on the accumulated inference result will be described in the description of the reliability calculation unit 240 .

Correspondence inference unit 230 uses a machine learning-based inference model learned in advance by the training unit for inference of the corresponding method. A type of inference model and a training process of the inference model will be described later.

The inference result of the inference model may include whether the detection event is a security threat and a countermeasure for the detection event.

Response measures for detection events include all or part of whether to notify customers, whether to request a judgment by a security control expert according to the ambiguity of threats, whether to report threats, whether to register in a blacklist, and whether to block or allow threats, etc. However, the present invention is not necessarily limited thereto, and any method that can be used as a countermeasure may be added. That is, the inference model can infer a plurality of countermeasures and whether they are executed. Meanwhile, whether the detection event is a security threat and the corresponding reliability may be used to determine whether to execute a countermeasure.

In addition, each response plan includes whether or not threat information, whether or not to filter in advance for threats, whether to notify customers about threats, whether to process blacklists for threats, reporting information on threats, and blocking and rejecting threats by firewalls All or part of the log may be included, but the present invention is not limited thereto, and any information capable of expressing other countermeasures may be added.

The reliability calculation unit 240 according to the present embodiment calculates the reliability of the inferred response plan. The reliability calculation unit 240 includes a low reliability event DB (241).

The corresponding solution inferred by the inference model may be expressed as a prediction probability. The output side of the inference model may be implemented as a logistic function (same meaning as a sigmode function). If the threshold for judgment is applied to the logistic function value, a situation in which judgment is ambiguous near the threshold may occur. Therefore, the reliability of the response plan can be calculated by re-adjusting the predicted probability of the inferred response plan based on the regression analysis. The target variable for regression analysis is a value adjusted by reflecting the review result of the security control expert, and can be continuously updated.

Since the countermeasure inferred as described above is precisely whether the countermeasure is executed or not, the high reliability of the countermeasure means that the execution or non-execution of the countermeasure is definitive. Conversely, the low reliability means that the implementation of the countermeasure is ambiguous.

The reliability calculator 240 compares the calculated reliability with a preset threshold. When the calculated reliability is lower than a preset threshold, the detection event is classified as a low reliability event. Here, the low reliability means that both the reliability of whether the detection event is a security threat and whether the countermeasure is executed is lower than the threshold. A low-reliability event is requested to be reviewed by a security control expert. This is because automatic responses based on unreliable reasoning results may rather cause another risk.

The reliability calculation unit 240 stores the low-reliability event and the response plan label provided by the security control expert in the low-reliability event DB 241 .

Meanwhile, the reliability calculation unit 240 accumulates the calculated reliability and periodically compares it with the accumulated reliability possessed by other inference models included in the inference model group 231 . When the cumulative reliability of the currently selected inference model is lower than the cumulative reliability of the other inference models, the security control device 100 may replace the other inference model with a higher cumulative reliability to use the replaced model for inference of a subsequent countermeasure. .

The correspondence execution unit 250 according to the present embodiment executes the inferred response plan when the calculated reliability is equal to or greater than a preset threshold. Here, the reliability of the threshold or higher means that the reliability of whether the detection event is a security threat and whether the countermeasure is executed are all greater than or equal to the threshold. Since the inferred countermeasure accurately means whether to execute the countermeasure or not, the meaning of executing the countermeasure includes not responding.

Table 1 shows an example of a corresponding method executed by the corresponding execution unit 250 .

Since the inference model can generate a plurality of countermeasures, the correspondence execution unit 250 may execute each of the plurality of countermeasures as illustrated in Table 1. For example, if the detection event is a security threat, but the notification to the customer is inferred as non-execution, the response execution unit 250 may omit the notification to the customer and register the IP address where the security threat occurs in the blacklist. .

The retraining unit 260 according to the present embodiment performs online retraining on the inference model in use by using data stored in the low reliability event DB 241 .

Here, the online retraining means performing retraining on the learning model whenever data for learning is obtained. Contrary to this, offline retraining refers to accumulating and storing training data, and then performing retraining on the learning model at an appropriate time. In terms of efficient use of storage space, online training is preferred. Hereinafter, unless otherwise specified, retraining is assumed to be online retraining, but is not necessarily limited thereto.

The retraining unit 260 may perform incremental learning on the inference model in use based on the low-reliability event and response plan label stored in the low-reliability event DB 241 . Incremental learning is a learning method of updating parameters of a learning model based on retraining using added data. In general, it is possible to increase the inference accuracy of a learning model by using incremental learning. The low-reliability event is data that can quantitatively increase training data. Accordingly, it is possible to increase the inference accuracy of the inference model based on the incremental learning by the retraining unit 260 .

In another embodiment of the present invention, incremental learning may be performed on all M inference models included in the inference model group 231 based on the low reliability event DB 241 . An inference model with the highest cumulative reliability may be selected based on the results of incremental learning for the M inference models, and may be used in a subsequent reasoning process.

As described above, according to this embodiment, with respect to the security threat detection event provided by the existing security solution and detection equipment, it is possible to automatically infer a countermeasure for the detection event using a machine learning-based inference model. , it becomes possible to improve the reliability of automatic analysis and countermeasures, and to minimize the manual analysis and response process of security experts.

As described above, the security control apparatus 100 according to the present embodiment may have a machine learning-based inference model, and may perform a training process on the provided inference model. This inference model is based on detection events acquired from multiple security solutions and detection equipment, It can be a model that has been previously trained to make inferences possible.

Learning for an inference model belonging to the inference model group 231 includes initial learning, incremental learning, and update learning. Initial learning means generating an inference model and proceeding with learning. Incremental learning means performing online learning on the selected inference model during the reasoning process of the corresponding method. Renewal learning evaluates the cumulative reliability of all or part of the inference model belonging to the inference model group at regular intervals and, when unsatisfactory, resets all or some parameters of the inference model and performs learning again.

Since incremental learning has been described in the description of the retraining unit 260, a training process for initial learning or update learning of the inference model will be described with reference to FIGS. 3 and 4 below.

3 is a conceptual diagram for learning of an inference model group according to an embodiment of the present invention. 4 is a flowchart for training of an inference model according to an embodiment of the present invention. Here, Fig. 4 (a) is a flowchart for the training process of the entire inference model, and Fig. 4 (b) is an arbitrary inference model (Jth inference model, J is 1 or more) including a sub-model It is a flowchart for the training process for a natural number less than or equal to M).

As shown in FIG. 3 , the inference model group 231 includes M inference models. Each inference model can be implemented based on machine learning, and in more detail, an ensemble model using bagging and boosting based on a decision tree, eXtreme Gradient Boosting (XGboost) Alternatively, a Light GBM (Light Gradient Boosting Machine) model may be used as the inference model. An inference model using bagging and boosting may include K (K is a natural number) decision trees as submodels.

In addition, a deep learning model based on a support vector machine (SVM) or a neural network may be used as an inference model. In the case of a deep learning model, a Convolutional Neural Network (CNN) or Recurrent Neural Network (RNN) and another model combining them may be used as an inference model according to the transformation of input data. As long as it is a machine learning-based model that can be used for inference, there is no limitation on the type.

Hereinafter, with reference to the flowchart illustrated in (a) of FIG. 4 , a training process of the entire inference model will be described.

The training unit acquires a detection event for learning and a label (S401). Here, the label indicates whether the detection event is a security threat and whether a countermeasure for the detection event is executed. Since the types and contents of the corresponding methods have been described in the description of the correspondence inference unit 230 , further descriptions are omitted.

The training unit executes a pre-processing process (S402). A preprocessing process may be executed to compensate for variations between security solutions providing detection events. The training unit may fill in the blanks obtained in the detection event and correct errors included in the detection event.

The training unit generates input data by executing an encoding process (S403). The training unit extracts feature data from the detection event, digitizes characters or strings constituting the feature data, and generates input data in a form suitable for a machine learning-based inference model.

The training unit generates ensemble data for each inference model by applying bagging to the input data (S404). Here, bagging is a method of dividing the entire detection event for learning into M groups capable of overlapping, and applying the divided groups to each inference model.

Based on the M ensemble data, the M inference models generate inference results (S405).

The training unit calculates the reliability of the M inference results, and accumulates them to calculate the cumulative reliability ( S406 ).

As described above, since the label indicates whether the countermeasure is executed or not, the high reliability of the inference result targeting the label means that the execution or non-execution of the countermeasure can be determined. Conversely, the low reliability means that the implementation of the countermeasure is ambiguous.

The training unit updates the parameters of the M inference models based on the respective inference results and labels (S407). When updating the parameters of each inference model, boosting may be applied based on the accumulated reliability (see S406) for each inference model. That is, the update increment may be decreased for the parameters of the inference model showing high reliability, and the update increment may be increased for the parameters of the inference model showing low reliability.

When the initial learning or update learning for the inference model group 231 is completed, the training unit compares the accumulated reliability and ranks the reliability of each inference model. Thereafter, the highest-ranking inference model may be selected and used for inferring a response plan of the security control device 100 . An inference model may be replaced based on a comparison between the cumulative reliability in the reasoning process of the selected inference model and the cumulative reliability of another inference model.

Hereinafter, a training process for an inference model including K submodels will be described with reference to the flowchart illustrated in FIG. 4B .

The process of preparing ensemble data for the inference model is the same as or similar to steps S401 to S403 of FIG. 4A .

The training unit generates ensemble data for each sub-model by applying a bagging method to the input data (S411). Here, the input data means the ensemble data assigned to the inference model, and is a part of the detection event for overall training. Bagging is a method of dividing ensemble data assigned to an inference model into K overlapping subgroups, and applying the divided subgroups to each submodel.

The K sub-models generate sub-inference results based on the ensemble data (S412).

The training unit calculates and accumulates the reliability for the K inference results to calculate the cumulative reliability (S413).

The training unit generates a weighted inference result by applying a weight to the K sub-inference results (S414).

The training unit updates the weights using boosting based on the accumulated reliability (S415). Here, boosting is an operation of increasing a weight for a submodel with high reliability and decreasing a weight for a submodel with low reliability.

The process of processing the inference result follows steps S406 and S407 of FIG. 4A. Here, the updating of the parameters for the inference model including the submodel means updating the parameters of the submodel.

When updating the parameters of the submodels, boosting may be applied based on the accumulated reliability (refer to S413) for each submodel. That is, a parameter for a submodel with high reliability may decrease the update increment, and a parameter for a submodel with low reliability may increase the update increment.

In the inference model including the submodel, when boosting is applied to the submodel, the cumulative reliability of the inference model may be reflected. That is, based on the cumulative reliability of the inference model, the increment of the parameter update of the submodel can be adjusted as a whole.

5 is a flowchart of a security control method according to an embodiment of the present invention.

The security control device 100 obtains a detection event from security solutions and detection equipments (S501).

The security control device 100 refers to the rule DB 211 and executes rule-based filtering (S502). Here, the rule DB 211 stores a rule set in advance.

The security control device 100 checks whether the detection event satisfies the rule (S503), and if the rule is satisfied, the security control device 100 responds to the detection event by using the countermeasure DB 212 (S504). Here, the countermeasure DB 212 stores an appropriate countermeasure for each detection event. For example, detection events originating from well-known attack locations such as blacklist Internet Protocol (IP) addresses may be removed. When the response to the detection event is executed, the security control device 100 may omit the inference process of the response plan for the detection event.

If the detection event does not satisfy the rule, the security control device 100 executes a pre-processing (S505). A preprocessing process is performed to compensate for deviations between security solutions that provide detection events. In the pre-processing process, the security control device 100 may fill in the obtained part as an empty space within the detection event, and may correct an error included in the detection event.

The security control device 100 generates input data by executing an encoding process (S506). In the encoding process, the security control device 100 extracts feature data from the detection event, digitizes characters or strings constituting the feature data, and generates input data in a form suitable for a machine learning-based inference model.

The security control device 100 infers a countermeasure by inputting the input data into the selected inference model (S507). The security control device 100 selects one inference model from among the M inference models included in the inference model group 231, and infers a countermeasure using it.

A model having the greatest cumulative reliability according to prior learning of the M inference models may be selected as the inference model. The inference model is a machine learning-based model and can be trained in advance.

The inference result of the inference model may include whether the detection event is a security threat and a countermeasure for the detection event. Whether the detection event is a security threat and the corresponding reliability may be used to determine whether to implement a countermeasure.

The security control device 100 calculates the reliability of the inferred response plan (S508). Reliability may be calculated by re-adjusting the prediction probability for the inferred response method based on regression analysis.

The security control device 100 checks whether the reliability is greater than or equal to a preset threshold (S509).

When it is determined that the reliability is greater than or equal to the preset threshold, the security control device 100 executes the inferred countermeasure (S510).

When the reliability is lower than the preset threshold, the security control device 100 classifies the detection event as a low-reliability event, and requests a review by a security control expert (S511).

The security control device 100 stores the review result by the security control expert and executes retraining for the inference model (S512).

The security control device 100 stores the low-reliability event and the response plan label provided by the security control expert in the low-reliability event DB 241 . The security control device 100 is in use using data stored in the low-reliability event DB 241. Perform online retraining of the inference model. Here, the online retraining means performing retraining on the learning model whenever data for learning is obtained.

The security control device 100 may perform incremental learning on the inference model being used based on the low-reliability event and response plan label stored in the low-reliability event DB 241 .

As described above, according to the present embodiment, by providing a machine learning-based automated security control device and method, over-detection and erroneous detection of a security solution and a previously detected event of a detection device are provided. ) has the effect of being able to identify and remove it in advance.

In addition, according to this embodiment, by providing an automated security control device and method based on machine learning, while correcting errors in the existing response results, in using the existing accumulated results, the difference in the capabilities of individual security experts There is an effect that it becomes possible to minimize the uncertainty due to the level difference of the resulting countermeasures.

Although it is described that each process is sequentially executed in each flowchart according to the present embodiment, the present invention is not limited thereto. In other words, since it may be applicable to change and execute the processes described in the flowchart or to execute one or more processes in parallel, the flowchart is not limited to a time-series order.

Various implementations of the systems and techniques described herein may be implemented in digital electronic circuitry, integrated circuitry, field programmable gate array (FPGA), application specific integrated circuit (ASIC), computer hardware, firmware, software, and/or combination can be realized. These various implementations may include being implemented in one or more computer programs executable on a programmable system. The programmable system includes at least one programmable processor (which may be a special purpose processor) coupled to receive data and instructions from, and transmit data and instructions to, a storage system, at least one input device, and at least one output device. or may be a general-purpose processor). Computer programs (also known as programs, software, software applications or code) contain instructions for a programmable processor and are stored on a "computer-readable recording medium".

The computer-readable recording medium includes all types of recording devices in which data readable by a computer system is stored. These computer-readable recording media are non-volatile or non-transitory, such as ROM, CD-ROM, magnetic tape, floppy disk, memory card, hard disk, magneto-optical disk, and storage device. media, and may further include transitory media such as carrier waves (eg, transmission over the Internet) and data transmission media. In addition, the computer-readable recording medium is distributed in network-connected computer systems, and computer-readable codes may be stored and executed in a distributed manner.

Various implementations of the systems and techniques described herein may be implemented by a programmable computer. Here, the computer includes a programmable processor, a data storage system (including volatile memory, non-volatile memory, or other types of storage systems or combinations thereof) and at least one communication interface. For example, a programmable computer may be one of a server, a network appliance, a set-top box, an embedded device, a computer expansion module, a personal computer, a laptop, a Personal Data Assistant (PDA), a cloud computing system, or a mobile device.

The above description is merely illustrative of the technical idea of this embodiment, and various modifications and variations will be possible without departing from the essential characteristics of the present embodiment by those skilled in the art to which this embodiment belongs. Accordingly, the present embodiments are intended to explain rather than limit the technical spirit of the present embodiment, and the scope of the technical spirit of the present embodiment is not limited by these embodiments. The protection scope of this embodiment should be interpreted by the following claims, and all technical ideas within the scope equivalent thereto should be interpreted as being included in the scope of the present embodiment.

100: security control device 200: input unit
210: rule-based filter unit 220: pre-processing and encoding unit
230: correspondence reasoning unit 231: inference model group
240: reliability calculation unit 241: low reliability event DB
250: response execution unit 260: retraining unit

Claims (18)

an input unit for acquiring detection events for a security threat;
an encoding unit converting the detection event into input data;
Correspondence inference unit for inferring a corresponding method for the detection event by inputting the input data into an inference model, wherein the inference model is pre-selected from a group of inference models, and the corresponding method is a prediction probability, indicating whether the countermeasure is implemented;
A reliability calculation unit for calculating the reliability of the corresponding method based on the prediction probability: And
Correspondence execution unit that executes the response plan depending on the calculated reliability
Security control device comprising a. According to claim 1,
A rule-based filter unit further comprising a rule-based filter unit, wherein the rule-based filter unit includes a rule DB (Database) and a countermeasure DB, and filters the detection event based on a rule with reference to the rule DB; If it matches, the security control device, characterized in that it executes the countermeasure for the detection event with reference to the countermeasure DB. According to claim 1,
A pre-processing unit that fills in the obtained part with an empty space in the detection event, corrects an error included in the detection event, and compensates for deviations between detection events according to security solutions Security control device, characterized in that it further comprises. According to claim 1,
The encoding unit,
The security control device, characterized in that extracting the feature data from the detection event, and converting the character or character string constituting the feature data into input data to a numerical value. According to claim 1,
The inference model group is
Security control device comprising at least one model, each of which is implemented based on machine learning, wherein each of the models is trained in advance. 6. The method of claim 5,
After completing prior training for each model included in the inference model group, a model having the highest cumulative reliability is selected as the inference model, wherein the cumulative reliability is a prediction generated by each model in the prior training A security control device, characterized in that it is generated by accumulating the reliability generated based on the probability. According to claim 1,
The reliability calculation unit,
Calculate the reliability of the corresponding method by re-adjusting the prediction probability for the corresponding method based on regression analysis, and when the reliability is lower than a preset threshold, classify the detection event as a low reliability event, and A security control device, characterized in that the low-reliability event and the corresponding countermeasure label are stored in the low-reliability event DB. 8. The method of claim 7,
Based on the data stored in the low-reliability event DB, the security control device characterized in that it further comprises a retraining unit for performing incremental learning (incremental learning) for the selected inference model. In the learning method of a security control device implemented on a computer,
a process of obtaining detection events and labels for a security threat, wherein the label is whether a countermeasure for the detection event is executed;
extracting feature data from the detection event and converting a character or character string constituting the feature data into input data;
generating ensemble data for at least one inference model based on machine learning by applying bagging to the input data;
generating an inference result by applying the ensemble data for each inference model, wherein the inference result is a prediction probability indicating whether the corresponding method is executed;
calculating reliability for the inference result based on the prediction probability for each inference model, and accumulating the reliability to calculate cumulative reliability; and
The process of updating parameters for each inference model based on the inference result and the label
Learning method of the security control device, characterized in that it comprises a. 10. The method of claim 9,
The method further comprises a pre-processing step of filling in an empty space in the detection event and correcting an error included in the detection event to compensate for deviations between detection events according to a security solution. learning method of security control device. 10. The method of claim 9,
The process of generating the ensemble data is
A learning method of a security control device, characterized in that the input data is divided into groups with the same number of groups as the inference model, allowing redundancy. 10. The method of claim 9,
The process of updating the parameters is
The learning method of the security control device, characterized in that for updating each parameter of the inference model using boosting based on the cumulative reliability. 10. The method of claim 9,
After terminating the learning of each of the inference models, the ranking of each of the inference models is determined by comparing the cumulative reliability of each inference model, and the highest ranking inference model is selected and used for inferring the countermeasure of the security control device Learning method of the security control device, characterized in that. In the security control method of a security control device implemented on a computer,
acquiring detection events for a security threat;
extracting feature data from the detection event and converting a character or character string constituting the feature data into input data;
The process of inputting the input data into an inference model to infer a response method for the detection event, wherein the inference model includes at least one pre-trained machine learning-based model preselected from a group of inference models, wherein the corresponding solution is a predicted probability, indicating whether the corresponding solution is to be executed; and
Calculating the reliability of the corresponding method based on the prediction probability, and executing the corresponding method depending on the reliability
A security control method of a security control device comprising a. 15. The method of claim 14
referring to a rule DB (Database), performing filtering on the detection event based on a rule, and if the detection event matches the rule, executing a countermeasure for the detection event with reference to a countermeasure DB; and
A pre-processing process of compensating for deviations between detection events according to a security solution by filling in missing data in the detection event and correcting errors included in the detection event
Security control method of the security control device, characterized in that it further comprises. 15. The method of claim 14,
classifying the detection event as a low-reliability event when the reliability is lower than a preset threshold, and storing the low-reliability event and a corresponding countermeasure label in a low-reliability event DB; and
The process of executing incremental learning on the inference model based on the data stored in the low-reliability event DB
Security control method of the security control device, characterized in that it further comprises. A computer program stored in a computer-readable recording medium to execute each step included in the learning method of the security control device according to any one of claims 9 to 13. A computer program stored in a computer-readable recording medium to execute each step included in the security control method of the security control device according to any one of claims 14 to 16.

Images